Massive 'TrapDoor' Supply Chain Attack Hits Open-Source; GitHub & Grafana Breached; Critical Drupal RCE Exploited

The Iranian APT, also known as Nimbus Manticore, has evolved its tactics by employing SEO poisoning to distribute a new backdoor named 'MiniFast'. This marks their first observed use of SEO poisoning, creating fake software download pages (e.g., for Oracle SQL Developer) to trick users. The campaign, active from February to April 2026, now targets aviation and software companies across the U.S., Europe, and the Middle East. The group continues to leverage AppDomain hijacking, now described as DLL side-loading, to achieve persistence and evade detection, indicating a strategic shift from traditional phishing to more sophisticated inbound threat vectors.

The new article provides a hypothetical example of the malicious GitHub Actions workflow used for secret exfiltration, showing how attackers collect and send sensitive data to their servers. It also details additional mitigation strategies, such as using OpenID Connect (OIDC) for short-lived credentials and enforcing signed commits, to enhance security against such supply chain attacks. This adds valuable technical depth to the understanding of the attack methodology and defense.

Following the recent source code theft, Grafana Labs has provided an update on the incident. The company confirmed that its investigation found no customer data was exposed and its services remained undisrupted. Furthermore, Grafana Labs publicly announced its refusal to pay the ransom demanded by the attackers for the stolen codebase. This stance highlights their commitment to transparency and not engaging with extortionists, despite the continued threat of the stolen code being leaked.

The critical SQL injection vulnerability, CVE-2026-9082, continues to be actively exploited in the wild. Following CISA's earlier alert, the Cyber Security Agency of Singapore (CSA) has now also issued an advisory confirming widespread exploitation, emphasizing the urgent need for patching. The vulnerability, detailed in Drupal security advisory SA-CORE-2026-004, affects Drupal core versions from 8.9.0 up to 11.x when using a PostgreSQL database. While the SQL injection is specific to PostgreSQL, Drupal also advises all users, regardless of their database backend, to update due to other important third-party library fixes (Symfony, Twig) included in the same security releases. Administrators should prioritize updating and checking for signs of compromise.